[ENG-1166] Route chart release notes through Lunar

[vladaionescu]

Part of ENG-1166.

What

Routes future Helm chart release-note prose through Lunar's canonical fragment pipeline. Chart PR merges notify Lunar for continuous drafting, while chart publication sends only verified release metadata and links the GitHub Release to the canonical Self-hosted GitBook page.

Why

The charts repository and Lunar previously risked maintaining two independently authored release-note sources. Keeping structured prose in Lunar gives Self-hosted releases one source of truth while preserving the Helm chart as the availability boundary.

How

• Dispatches source repository, merge SHA, and PR hints after charts PR merges, with weekday reconciliation for missed events.
• Verifies the published chart tag and package, extracts the packaged Hub image version, and sends a metadata-only completion callback.
• Replaces chart GitHub Release prose with a link to the canonical Self-hosted release-note page.
• Removes the maintained chart changelogs and their GitHub Release synchronization script.
• Keeps the existing explicit chart-publication dispatch and daily reconciliation path.

Anything else

This draft depends on earthly/lunar#2087 plus the companion Lunar publication PR earthly/lunar#2101. Both Lunar workflows must be live before these callbacks are enabled on charts main.

🤖

[lunar-internal]

🌒 Earthly Lunar

❌ 1 Failing

• ❌ changelog-exists changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects
  common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md,
  RELEASES.md). Intended for repos that ship versioned releases — apply
  via lunar-config on: targeting (e.g. public-only) rather than blanketly.
  Reads from .repo.changelog.

  • No CHANGELOG file found. Add a CHANGELOG.md to record notable changes per release (see https://keepachangelog.com/).

More Details

✅ 14 Passing

The checks marked as (🔀 required) need to pass before merging is allowed.

• ✅ max-severity sca-critical.max-severity - Ensures no findings at or above the configured severity threshold.
  Configure min_severity to set the threshold (critical, high, medium, low).
  (🔀 required)

• ✅ branch-protection-enabled vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch.
  Branch protection is the foundation for all other VCS security controls.

• ✅ build-tagged container.build-tagged - Requires container builds to use an explicit image tag via -t/--tag.
  Untagged builds produce anonymous images that cannot be tracked or deployed.

11 more...

• ✅ codeowners-catchall repo-hygiene.codeowners-catchall - Requires a default catch-all rule (*) in CODEOWNERS so that every file
  in the repository has at least one owner.

• ✅ codeowners-exists repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository.
  Checks standard locations: root, .github/, or docs/.

• ✅ codeowners-valid repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax.
  Checks that all owner references use valid formats (@user, @org/team, or email).

• ✅ disallow-force-push vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history.
  Force pushes can destroy audit trails and cause data loss.

• ✅ instruction-file-exists ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks
  ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and
  tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md).
  Passes if any entry exists.

• ✅ max-severity sca-high.max-severity - Ensures no findings at or above the configured severity threshold.
  Configure min_severity to set the threshold (critical, high, medium, low).

• ✅ no-latest container.no-latest - Prevents use of the :latest tag (explicit or implicit) in base images.
  Using :latest creates non-reproducible builds and makes debugging difficult.

• ✅ readme-exists repo-hygiene.readme-exists - Verifies that a README file exists in the repository root.
  Every repository should have basic documentation for discoverability.

• ✅ require-default-branch vcs.require-default-branch - Validates the default branch name matches the required name (default "main").
  Helps standardize branch naming across repositories.

• ✅ require-pull-request vcs.require-pull-request - Requires all changes to go through pull requests before merging.
  Prevents direct pushes to protected branches without review.

• ✅ stable-tags container.stable-tags - Requires base images to use stable tags: digests (sha256:...) or full semver (1.2.3).
  Partial versions like "node:20" can change unexpectedly and break builds.

More Details